Posted By

Rectifier on 07/01/12

Tagged

Versions (?)

Last Edited at 07/01/12 03:54am

Statistics

Viewed 1249 times

Favorited by 0 user(s)

Related snippets

Save (and clear) Windows Event Logs

/ Published in: DOS Batch

Uses the sysinternals (microsoft) utility PsLogList to save specified event logs to files and then clears them. Method can be used to save logs as .evt and .evtx. This script has four event logs listed as an example and has a template command commented. Tested on a local windows 7 machine, but should work for xp, server 2k3 and 2k8.

Highlighted TextExpand

@echo off
@cls
::Originally written by the user wesil on spiceworks.com
::Modified by Rectifier 06-30-2012
::This batch requires you to download the sysinternals (microsoft) utility psloglist
::Try http://technet.microsoft.com/en-us/sysinternals or google psloglist

::Tested on a local machine using psloglist.exe version 2.71 on Windows 7 x64 Home Premium
::Use the ping command to wait from XP onward, timeout works for server 2k3
::The -g switch only works after the -c switch; this saves the log to file and clears it

::You can change the file extension from evt (older) to evtx (newer) and vice versa

::Change pstooldir to where psloglist.exe is located
set pstooldir=C:\PSTools
cd /d %pstooldir%
::Error handling
if not exist psloglist.exe goto ERR0
if not exist "Event Logs" md "Event Logs"
if not exist "Event Logs" goto ERR1
::Change logdir to where you want to save the event logs
set logdir=C:\Event Logs
::Template command for saving an event log:
::psloglist.exe -s -c -g "yourdir\filename %date:~4,2%-%date:~7,2%-%date:~10,4%.extension" "log name"
::Saved files appear as "filename MM-DD-YYYY.extension" without quotations

::Exports to file and then clears the following event logs
psloglist.exe -s -c -g "%logdir%\Security %date:~4,2%-%date:~7,2%-%date:~10,4%.evtx" Security
psloglist.exe -s -c -g "%logdir%\Application %date:~4,2%-%date:~7,2%-%date:~10,4%.evtx" Application
psloglist.exe -s -c -g "%logdir%\System %date:~4,2%-%date:~7,2%-%date:~10,4%.evtx" System
psloglist.exe -s -c -g "%logdir%\Internet Explorer %date:~4,2%-%date:~7,2%-%date:~10,4%.evtx" "Internet Explorer"
goto end

:ERR0
echo. & echo.
echo psloglist.exe not found !
ping 127.0.0.1 -n 2 >nul
goto emd

:ERR1
echo. & echo.
echo Can't create folder "Event Logs"
ping 127.0.0.1 -n 2 >nul
goto end

:end
::Uncomment the pause to view the output before ending the batch file
::pause
exit /b

Report this snippet Tweet

Comments

Subscribe to comments

Comment:

You need to login to post a comment.